Stealthing the IDS ICSSCADA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a recommended practice for managing a stealth IDS sensor to avoid exposing it on the ICS network?

   • AShare the sensor's management credentials with all ICS administrators
   • BAllow management traffic to flow through the same switch as production traffic
   • CUse a dedicated out-of-band management network
   • DUse Telnet for management because it is simpler
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security engineer is deploying an IDS sensor in a SCADA network. The sensor's monitoring interface is connected to a network TAP. The engineer wants to make the sensor's management interface less discoverable. Which action is most effective?

   • AConfigure the management interface to use a MAC address that is randomly generated and not tied to the sensor's vendor.
   • BDisable the management interface entirely and manage the sensor only through the console port.
   • CPlace the management interface on a separate VLAN with no route from the OT network.
   • DAssign the management interface a static IP address that is not in the same subnet as the OT devices.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is deploying a stealth IDS on a control network that has a mix of IT and OT devices. The team wants to minimize the sensor's footprint while ensuring it can still detect attacks. The sensor will be managed via a jump host. Which configuration best achieves stealth while maintaining manageability?

   • AEnable SSH on the monitoring interface for remote management, and use a non-standard port.
   • BDisable all services on the monitoring interface, use a passive TAP, and allow management only from the jump host via an out-of-band network.
   • CUse an inline IPS with fail-open and configure it to send alerts via email over the control network.
   • DPlace the sensor on the same VLAN as the engineering workstations and use a host-based firewall.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key challenge when deploying a stealth IDS in an ICS/SCADA network?

   • AThe IDS must avoid being detected while still receiving the network traffic it needs to monitor
   • BThe IDS must use encryption to protect its own communications
   • CThe IDS must be assigned a routable IP address to communicate with the SIEM
   • DThe IDS must be placed inline to inspect all traffic, which can introduce latency
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing plant has a critical control network with a switch that supports port mirroring. The security team wants to deploy a passive IDS to monitor traffic between two PLCs. The switch is also used for normal control traffic and cannot be rebooted during production. Which deployment step is most appropriate?

   • AInstall a network TAP by physically cutting the cable between the two PLCs and inserting the TAP.
   • BPlace the IDS sensor inline between the two PLCs and configure it to forward traffic.
   • CConfigure a SPAN session on the switch to mirror the traffic from the two PLC ports to the IDS sensor port.
   • DConnect the IDS sensor to a hub that is placed between the two PLCs.
   Reveal Solution Discussion Select an answer first